SharePoint consulting for clinical and administrative teams
The documents that run a practice sit outside the chart: the policy and procedure manual nobody can prove was read, provider files with licences expiring in a spreadsheet, accreditation evidence assembled from scratch every survey cycle, and a share drive where anyone can open anything. We configure that inside the Microsoft 365 tenant you already pay for — libraries with owners, effective dates and review cycles, acknowledgment records, permission boundaries kept to the minimum necessary, and retention that starts when the record says it should. One written fixed fee, typical delivery in 2–4 weeks, 30 days of hypercare included.
Representative dashboard — sample data
What we configure
Every one of these is configuration of tools already inside your Microsoft 365 licences — scoped in writing before anything is built.
One published library where each policy carries an owner, an approving committee, an effective date and a next-review date — and where drafts stay invisible until approved, so staff cannot open last year’s version by accident.
A record of who acknowledged which policy, at which version, on which date — built as a list and a flow because SharePoint has no attestation feature of its own. An unanswerable question becomes a report you can export.
A file per provider holding licences, board certifications, DEA registrations, malpractice coverage and verification documents, with expiration and re-credentialing dates as real date columns that can drive a reminder.
Evidence tagged to the standard it answers, with a named owner and the date it was last refreshed, so preparing for a survey is a filtered view rather than six weeks of collecting documents into a binder.
Permission boundaries drawn per site rather than inherited down a folder tree, external sharing turned off where documents must not leave, and access requests routed to an owner instead of granted by whoever holds the link.
Retention labels whose clock starts at the event your schedule names rather than at whenever a file was last touched, with review before anything is destroyed and a record that it was destroyed on purpose.
How it works
A free consultation covers who writes and approves a policy today, how staff find out it changed, where credential files and payer contracts live, what your retention schedule already says, and which documents may never leave the organization. We reply with a written scope, one fixed fee and a delivery date.
We configure the library structure, content types, metadata, approval, acknowledgment flow and permission model for a single department first, then try to reach it from an account that should not — before anything sensitive is moved in.
Content moves in agreed waves with owners, effective dates and review dates applied on the way in, library owners and compliance staff are trained on publishing and re-review, and we stay on for 30 days of included hypercare.
The pattern is the same in a six-provider clinic and a three-site group. There is a folder called Policies, and inside it a document named with some combination of the year, the word final and somebody’s initials. There is a second copy on the intranet that was accurate in 2023. The annual review lives in the compliance officer’s calendar, the approval lives in committee minutes nobody can find, and the answer to “can you show me that every clinical staff member read the current infection control policy” is an email thread.
None of that is a filing discipline problem. A folder cannot hold a state. It has no owner field, no effective date, no next-review date, no approval status and no way to distinguish a draft from the published version, so every one of those attributes has to live in a human head or a parallel spreadsheet. The fix is to make the document an object the platform understands: a content type for a policy, with the owner, the approving body, the effective date, the review cycle and the standard it maps to as real columns, a library that publishes only approved major versions, and retired versions kept as evidence rather than in circulation.
Once that exists, questions that used to take an afternoon become views. Which policies are past their review date. Which ones this committee owns. Which were approved since the last survey. Which have never been acknowledged by the night shift. The work is deciding those attributes with the people who own the manual — not installing anything.
This is the translation table we scope against. Your build takes the rows that match how the organization runs — a single clinic and a multi-site group with a credentialing coordinator land in different places on several of them — but the conversation is the same every time.
| What the organization calls it | What it becomes in SharePoint | Why the folder version cannot do it |
|---|---|---|
| Policy and procedure manual | A published library with a policy content type: owner, approving committee, effective date, next-review date, status | A folder cannot mark a document as current, so the newest file and the correct file are not the same thing |
| Annual policy review | A review-date column driving a filtered view and a scheduled reminder to the named owner | The review cycle exists only in one person’s calendar, and leaves with that person |
| Read-and-sign acknowledgment | An acknowledgment list plus a Power Automate flow recording person, policy, version and timestamp | “Everyone was emailed it” is not evidence that anyone opened the current version |
| Credentialing file | A per-provider document set in a restricted site, with licence, certification and coverage expiry as date columns | An expiry date typed into a filename cannot be sorted, filtered or used to warn anyone |
| Accreditation evidence | An evidence library tagged with the standard or chapter it answers, plus owner and last-reviewed date | Rebuilding the binder each cycle means re-finding documents that were never lost, only unlabelled |
| Payer contracts and vendor BAAs | A contracts library with counterparty, effective and termination dates, and a retention label keyed to termination | Nothing about a folder changes when a contract ends, so the retention clock never starts |
| Consent, intake and clinical forms | A forms library holding the approved master of each form, versioned, with superseded versions withdrawn from view | Printed-from-a-copy forms circulate for years after the master changed, and nobody can tell which is in use |
| Training and competency records | A per-employee record set with completion dates, kept separate from the department’s working documents | Employee health and competency records inherit the department folder’s permissions, which are far too broad |
| Minimum necessary access | Unique permissions per site, external sharing off where required, access requests routed to a named owner | Folder permissions inherit downwards and are invisible in search results and shared links |
| Record retention schedule | Purview retention labels and policies enforcing the periods your compliance lead has already decided | A written schedule nobody can enforce is a document about deletion, not deletion |
Read this part before you read anyone’s sales page, including ours. There is no HIPAA certification for software or for a consultancy. Microsoft’s own HIPAA and HITECH documentation (opens in new tab) states that there is currently no certification standard approved by the Department of Health and Human Services for demonstrating compliance by a business associate, that Microsoft enters into Business Associate Agreements with its covered entity and business associate customers, and — in answer to its own FAQ — that having a BAA with Microsoft does not on its own achieve HIPAA compliance, because your organization remains responsible for its compliance program and for how it uses the services. SharePoint Online appears on that page’s list of in-scope commercial services. Anyone offering you a compliant SharePoint is selling something that does not exist.
What can be engineered is the configuration your compliance officer’s decisions imply. Access is the one people get wrong most often, and the default is the reason: Microsoft’s external sharing documentation (opens in new tab) notes that external sharing is turned on by default for the whole SharePoint and OneDrive environment, that the setting exists at both organization and site level with the more restrictive value winning, and that content which should not be shared externally belongs in a site with external sharing turned off. That is a design decision, not a policy reminder — a link to a credentialing file cannot be created if the site cannot create one.
Above that, container-level sensitivity labels for groups and sites (opens in new tab) can set and lock a site’s privacy, guest access and external sharing, and can limit access from unmanaged devices where Microsoft Entra Conditional Access is configured. Two honest caveats: those settings depend on features your current licensing may not include, and a label applied to a site does not encrypt or mark the items inside it — container protection and item protection are separate things. We check what your plan actually covers during scoping rather than designing around a feature you would have to buy.
| Compliance question | What the platform provides | What stays your organization’s responsibility |
|---|---|---|
| Business associate agreement | Microsoft offers a BAA to covered entity and business associate customers covering in-scope services, SharePoint Online among them | Executing it, knowing which services are in scope, and every other vendor relationship you hold |
| Who can open what | Site-level permission boundaries, unique permissions, access requests, guest sign-in under the guest’s own identity | Deciding what minimum necessary means for each role, and reviewing membership after people move or leave |
| Keeping documents inside | Organization- and site-level external sharing controls, with the more restrictive setting applying | Naming which content may never be shared externally, and approving the exceptions when they arise |
| Retention and destruction | Purview retention policies at site level, retention labels at item level, event-based clocks, disposition review | The retention schedule itself — the periods, the triggering events, and the legal basis for both |
| Evidence of activity | Unified audit logging of file access, sharing and label changes across Microsoft 365 | Deciding what is reviewed, how often, by whom, and what a review finding triggers |
| Workforce awareness | A single published version of each policy plus an acknowledgment record we build for you | Writing the policies, training the workforce, and acting when the acknowledgment report shows a gap |
A necessary line, stated the same way we state it on every engagement: this is configuration work, not compliance consulting and not legal advice. We do not perform risk analyses, write your policies, interpret the Privacy Rule for your organization or opine on your retention periods. Your compliance officer decides; we build the tenant so those decisions are enforced by the platform instead of by memory, and we document what was configured so it can be reviewed. If your organization requires specific agreements or restrictions from any vendor touching this environment, raise them in the free consultation and they go into the written scope before work starts.
Most healthcare organizations have a written retention schedule and very little ability to enforce it, because enforcement in a folder tree means somebody identifying documents by hand and deleting them on purpose — which nobody wants to be the person to do. Microsoft’s documentation on retention policies and retention labels (opens in new tab) draws the distinction that matters here: a retention policy assigns the same settings at site or mailbox level, while a label assigns settings to an individual item. Only labels can start the retention period when an event occurs — a contract expiring, an employee leaving — rather than from creation or last modification, and only labels support disposition review, where a named person confirms before content is permanently deleted.
For a provider organization that difference is the whole design. A baseline policy across the operational sites handles the general case; labels handle the categories your schedule treats differently, and the event-based clock is what lets a vendor agreement be kept for a fixed period after termination instead of a fixed period after upload. Where a schedule must not be quietly relaxed later, Preservation Lock exists to stop even an administrator from turning a policy off or making it less restrictive — a control worth understanding before you turn it on, because it is deliberately hard to undo.
What we do not do is decide any of it. Retention periods for medical and business records come from federal requirements, your state’s rules, payer and accreditation obligations, and your own counsel — a mix we are not qualified to resolve and would not put in a scope document. Bring the schedule your organization has already approved; we make the tenant enforce it and document exactly how.
Three shapes cover most requests from provider organizations. Every fee is fixed and put in writing after your free consultation — the table shows scope and typical timeline, because an honest number needs to see your document volume, your access requirements and your current licence position first.
| Engagement | What is configured | Typical timeline | Fee |
|---|---|---|---|
| Policy library | One published policy and procedure library: content types, owner and committee metadata, effective and review dates, approval before publication, filtered views for owners, and library-owner documentation | About 2 weeks | Fixed fee — scoped after your free consultation |
| Policy library with acknowledgment and credentialing | The above plus the acknowledgment list and Power Automate flow, a restricted credentialing site with expiry tracking and reminders, and the permission model and external sharing settings behind both | 2–3 weeks | Fixed fee — scoped after your free consultation |
| Organization-wide document control | Multi-department rollout, accreditation evidence and contracts libraries, retention labels including event-based clocks and disposition review, migration of agreed content off the file server with metadata applied in flight, and admin runbooks | 3–4 weeks | Fixed fee — scoped after your free consultation |
We publish no price list, because the number depends entirely on the scope agreed after your consultation. The wider drivers behind a SharePoint fee — number of sites, volume of content to migrate, how much of the structure has to be designed rather than moved — are broken down on our SharePoint intranet cost page, and the fixed-fee model itself is explained on how it works.
Small and mid-sized US provider organizations — independent practices, multi-site groups, dental and behavioral health, home health, therapy and community clinics, and the billing and management companies that serve them as business associates — already paying for Microsoft 365 and still running document control off a share drive. The trigger is usually one of five things: an accreditation survey on the calendar, a policy manual that has drifted past its review dates, a new compliance officer asking who can see what, a credential that expired without anyone noticing, or a server refresh quote. It is a poor fit for organizations that have not yet decided who owns the policy manual, because structure built on an undecided owner has to be rebuilt.
Worth saying plainly, because the two get confused: this page is about document control, not reporting. If what you actually need is scheduling, revenue-cycle and payer analysis on a screen, that is a different engagement — see our Power BI consultant for healthcare page instead. This one is the healthcare-shaped version of our wider SharePoint intranet and document management consulting, which covers the same engineering standards across any industry; the equivalent build for a practice of a different kind is our SharePoint consulting for law firms, and for a sector where most of the people who need a document are unpaid rather than on payroll — boards, committees and volunteers — it is our SharePoint consultant for nonprofits engagement. If the documents are still on a file server, our file server to SharePoint migration playbook explains why structure gets designed before anything moves. Organizations weighing Microsoft 365 Copilot should read how governance decides whether a Copilot rollout is safe first, since an assistant that summarises everything a user can already reach is a permissions problem before it is an AI problem. And the reminders behind expiring credentials and overdue policy reviews are automated approval and reminder workflows, not a spreadsheet somebody checks on Fridays. We work with organizations in all US states remotely from our Orange County, CA base.
Related services
The wider fixed-fee service: intranets, document management, migration and governance across any industry.
Acknowledgment capture, policy review reminders and credential expiry alerts running behind the libraries.
A written read on sharing settings, guest access and admin roles before sensitive documents move anywhere.
Further reading
Hand-written guides from our article library.
The step-by-step playbook for moving documents off a server share without carrying the mess across.
Why permissions and oversharing decide whether an AI rollout is safe where records are confidential.
The factors that move a fixed fee up or down on an intranet and document management project.
FAQ
No product is. Microsoft’s HIPAA documentation states there is currently no certification standard approved by the Department of Health and Human Services for demonstrating HIPAA compliance, and that using Microsoft services does not on its own achieve compliance. SharePoint Online is listed among the services covered by Microsoft’s Business Associate Agreement; how you configure it remains your organization’s responsibility.
No. The legal medical record stays in your EHR, and we do not move clinical documentation into SharePoint. This work covers the operational documents that sit outside the chart: policies and procedures, credentialing files, accreditation evidence, contracts, training records and forms. Any ePHI in scope is deliberate, minimal and agreed in writing first.
SharePoint has no native attestation feature, so we build it: the published policy library carries one current version, and a companion list plus a Power Automate flow records each acknowledgment with the person, the policy, the version and the timestamp. That record is the evidence a surveyor or your compliance committee asks for.
External sharing is on by default across a new tenant, and it is set at both organization and site level with the more restrictive value winning. Credentialing lives in a site with sharing turned off and unique permissions, so a link cannot be generated at all rather than relying on nobody generating one.
Yes, with retention labels. Microsoft Purview retention policies apply settings at site level, while labels apply at item level and can start the retention period from an event, such as a contract ending. Labels also support disposition review before deletion. Your compliance lead sets the periods; we configure what has been decided.
No custom code. Everything is configuration of SharePoint, Purview and the Microsoft 365 tools your organization already licenses, so nothing depends on us to keep running. The sites, libraries, content types, labels, flows and documentation stay in your tenant, and you get 30 days of hypercare after handover.
Book a free consultation
Tell us what you’re trying to fix — a report, an approval process, an intranet, a Copilot rollout. We scope it as a fixed-fee project, you approve, and a senior engineer delivers in 2–4 weeks.
The fastest way to reach us is the form — tell us the task and we’ll reply within one business day.